Entra Id
Monthly
Spoofing vulnerability in Microsoft Entra ID (formerly Azure Active Directory) enables an authenticated low-privilege network attacker to forge or manipulate identity data due to insufficient verification of data authenticity (CWE-345), yielding high confidentiality, integrity, and availability impact. The CVSS 8.8 score with PR:L confirms a valid tenant account is required but no elevated privileges are needed, meaning any compromised or legitimately provisioned low-privilege account could serve as a launchpad. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Azure Entra ID (formerly Azure AD) has an elevation of privilege vulnerability allowing attackers to escalate permissions within the identity platform.
Azure Entra ID Elevation of Privilege Vulnerability. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on another tenant. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Spoofing vulnerability in Microsoft Entra ID (formerly Azure Active Directory) enables an authenticated low-privilege network attacker to forge or manipulate identity data due to insufficient verification of data authenticity (CWE-345), yielding high confidentiality, integrity, and availability impact. The CVSS 8.8 score with PR:L confirms a valid tenant account is required but no elevated privileges are needed, meaning any compromised or legitimately provisioned low-privilege account could serve as a launchpad. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Azure Entra ID (formerly Azure AD) has an elevation of privilege vulnerability allowing attackers to escalate permissions within the identity platform.
Azure Entra ID Elevation of Privilege Vulnerability. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on another tenant. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.